langflow-ai/langflow v1.12.0

1.12.0

on GitHub

What's Changed

✨ New Features

• feat(models): add pluggable provider policy by @erichare in #14137
• feat: make langflow-core the shared bundle-free distribution by @erichare in #14100
• feat: add scoped authorization visibility prefilter by @erichare in #14102
• feat: automate bundle version propagation and release ordering by @erichare in #14160
• feat(ci): add declarative downstream bundle profiles by @erichare in #14208
• feat: Complete release 1.12 RBAC authorization foundations by @erichare in #14215
• feat: Complete RBAC and distribution contracts by @erichare in #14230
• feat: export application telemetry to any OTLP backend by @ogabrielluiz in #14213
• feat: Unified KBs and MBs to use common vector db backends by @dkaushik94 in #14239
• feat: add event-loop lag and DB pool saturation metrics by @ogabrielluiz in #14340
• feat: pgVector implementation for MBs and KBs by @dkaushik94 in #14287
• feat(models): establish provider governance foundation by @erichare in #14323
• feat(authz): add source-aware role assignment grants by @erichare in #14333
• feat(models): add approved provider policy store by @erichare in #14324
• feat: agent catalog foundations and migration by @erichare in #14316
• feat: support externally managed provider and catalog policies by @erichare in #14377
• feat: SSO foundations, login seams, and remove OSS Admin Page by @deon-sanchez in #14276
• feat: add shared database-backed policy bundle by @erichare in #14426
• feat: Remove use of vertex builds table in workflow API background mode by @Jkavia in #14353
• feat(security): opt-in exec-sandbox microVM backend for code-execution components by @erichare in #14400
• feat(agentic): Langflow Assistant improvements — flow building, model portability, and robustness by @Cristhianzl in #14007
• feat: add deterministic project deployment artifacts by @erichare in #14437
• feat(a11y): scan-first accessibility report and make test_frontend_a11y_suite by @viktoravelino in #14479
• feat: deployment-profile based pre-flight checks by @dkaushik94 in #14393
• feat: add enterprise lifespan hook registry and run-event store by @erichare in #14504
• feat: scope per-user memory to end-user identity header by @Jkavia in #14443
• feat: add deployment-wide blocked-model deny-list to policy bundle by @erichare in #14507
• feat: add catalog-policy component usage endpoints by @erichare in #14510
• feat: add an opt-in warm graph registry for sync execution by @Jkavia in #14290
• feat(authz): add durable audit persistence by @erichare in #14496
• feat: flow-execution span on every execution path, labelled by protocol by @ogabrielluiz in #14403
• feat: leak-safe LLM-provider latency and error metrics by @ogabrielluiz in #14231
• feat: add an OTLP doctor to confirm telemetry delivery by @ogabrielluiz in #14226
• feat: spans for MCP tool calls, emitted at the call site by @ogabrielluiz in #14423
• feat: database spans, and pin that sampling stays env-driven by @ogabrielluiz in #14420
• feat(authz): add anonymous PUBLIC authorization by @erichare in #14497
• feat: add telemetry for run executions by @Adam-Aghili in #14501
• feat: span for outbound A2A calls, emitted at the call site by @ogabrielluiz in #14520
• feat(api): add id-keyed project upsert endpoint by @jordanrfrazier in #14521
• feat: let operators turn off database spans by @ogabrielluiz in #14552
• feat: add OrcaRouter bundle component by @Marc-oss-hub in #14549
• feat(VectorDBs): Removed sidecar dependency and disk links for KBs and MBs by @dkaushik94 in #14413
• feat(bundles): lfx-confluent bundle + watsonx.data components (IBM streamhouse) by @erichare in #14612
• feat: add CustomModelProvidersEmptyState seam for model provider modal by @deon-sanchez in #14619
• feat(components): add MrScraper integration by @ai-mrscraper in #14516
• feat: propagate end-user identity across the serving plane by @Jkavia in #14550
• feat: link a queued run back to the request that queued it by @ogabrielluiz in #14616
• feat: enterprise readiness + telemetry exports by @Adam-Aghili in #14663
• feat: add deployment tweak policy and close the graph-path tweak bypass by @ogabrielluiz in #14538
• feat: resolve flow KB/MB dependencies into the deploy artifact by @Jkavia in #14728
• feat(frontend): add Settings password form gate seam for SSO overlays (LE-2318) by @deon-sanchez in #14818
• feat: add SSO identity details and account-menu profile header seam by @deon-sanchez in #14838
• feat(authz): audit role, team, assignment, and user admin mutations (LE-2350) by @deon-sanchez in #14874

🐛 Bug Fixes

• fix(a11y): admin and auth pages accessibility by @viktoravelino in #13998
• fix: assets/knowledge-base accessibility by @deon-sanchez in #13973
• fix: settings/messages accessibility by @deon-sanchez in #14064
• fix: complete shared resource access (LE-1828) by @erichare in #14101
• fix: settings/db-provider accessibility by @deon-sanchez in #13999
• fix(mcp): reap cancelled session transports by @erichare in #14214
• fix: preserve secret values across graph edges by @erichare in #14216
• fix: include Google as a default partner bundle by @erichare in #14220
• fix(rbac): add permission checks in api and use owner id for provider sync by @HzaRashid in #14104
• fix: graduate Azure and Ollama bundles by @erichare in #14248
• fix: normalize MCP resource flow IDs by @erichare in #14253
• fix: populate name and description on starter-projects API response by @erichare in #14256
• fix: render flows whose nodes have no position instead of crashing the canvas by @erichare in #14258
• fix(mcp): make agentic MCP server removal actually delete the row by @erichare in #14272
• fix(mcp): optimistic-lock concurrent MCP server PATCHes by @thesaadmirza in #14005
• fix: settings/mcp-client accessibility by @viktoravelino in #14112
• fix(a11y): label Password and Profile Picture form landmarks on settings/general by @olayinkaadelakun in #14030
• fix(mcp): pin MCP SDK <2.0 for uvx-launched servers by @viktoravelino in #14297
• fix: settings/mcp-servers accessibility by @viktoravelino in #14063
• fix: settings/model-provider Accessibility by @deon-sanchez in #13997
• fix(a11y): fix invalid ARIA, unnamed buttons, list markup, and touch targets on flow page by @olayinkaadelakun in #14210
• fix(shortcuts): announce recorded key combo via aria-live and add accessibility test coverage by @olayinkaadelakun in #14072
• fix(a11y): resolve IBM Equal Access violations on sidebar, canvas, and note contrast by @olayinkaadelakun in #14212
• fix: clean up Write File local staging under remote storage by @Jkavia in #14237
• fix(a11y): resolve Lighthouse button-name and aria-valid-attr-value failures in output modal by @olayinkaadelakun in #14278
• fix(playground): add accessible names to icon-only controls and fix invalid ARIA on animated/status elements by @olayinkaadelakun in #14110
• fix(deps): align system-metrics with the 0.65b0 opentelemetry family by @ogabrielluiz in #14350
• fix(frontend): don't trap users on a flow when save fails by @keval718 in #14358
• fix: replace models of disconnected providers by @Cristhianzl in #14362
• fix: align catalog policy component identities by @erichare in #14385
• fix: release SQLite lock after API key auth by @erichare in #14381
• fix: isolate CrewAI runtime state across build_crew calls by @Zhengcy05 in #13852
• fix(components): run user code input in Python REPL tool's run_model by @erichare in #14401
• fix: honor Tool Name/Description inputs in Python REPL tool component by @erichare in #14402
• fix(crewai): isolate shared agents per crew by @erichare in #14399
• fix(tests): stub SSRF transport in spoofed-metadata policy tests by @erichare in #14408
• fix: serialize model provider variable writes by @erichare in #14405
• fix: show Global Variables permission loading state by @erichare in #14404
• fix(a11y): name command palette, dialogs, and crash screen (LE-2043) by @viktoravelino in #14313
• fix(authz): support scoped project visibility by @erichare in #14429
• fix: allow project-scoped flow creation by @erichare in #14452
• fix: enforce approved catalog across alternate paths by @erichare in #14449
• fix(api): end request-scoped transactions before long-running execution by @erichare in #14448
• fix(frontend): drop stale refresh after code save by @Cristhianzl in #14460
• fix: strip query strings from URL attributes before spans are exported by @ogabrielluiz in #14422
• fix(a11y): resolve ARIA violations in MCP selector and sidebar settings, add axe coverage by @olayinkaadelakun in #14250
• fix: right-click inside a modal opened from a node no longer acts on the node by @tarciorodrigues in #14462
• fix(lfx): correct "comparision" typo in Filter Values component description by @erichare in #14476
• fix(tests): handle the Setup Provider state in selectGptModel (deterministic shard-65 failure) by @erichare in #14478
• fix(tests): click Save in the provider modal before waiting for the key-saved toast (shard-65) by @erichare in #14480
• fix(auth): add nested group-claim seam for LE-2102, LE-2103, and LE-2109 by @erichare in #14410
• fix(tests): require exact MCP server name match by @erichare in #14484
• fix(lfx): compare template keys directionally in the upgrade checker (1.12.0 port) by @erichare in #14483
• fix(tests): handle the Setup Provider state in the right-click-dropdown spec by @erichare in #14486
• fix(tests): require exact MCP server name match in remaining locators by @erichare in #14485
• fix: reject prompt variables in the reserved underscore namespace by @tarciorodrigues in #14450
• fix(a11y): accessible names, dialog titles, keyboard controls, and toast dismissal across viewers, chat, and modals by @viktoravelino in #14300
• fix(authz): enforce execution principal boundaries by @erichare in #14495
• fix: correct sync GET-status session_id; gate result cache behind a flag by @Jkavia in #14512
• fix: validate production preflight secret key by @erichare in #14499
• fix(deps): require cryptography 50 by @erichare in #14514
• fix(deps): raise vulnerable Python dependency floors by @erichare in #14513
• fix: stop shipping application telemetry to the LLM tracing vendor by @ogabrielluiz in #14357
• fix: keep LLM tracing vendors off the global tracer provider, and pin it by @ogabrielluiz in #14359
• fix: require stored credentials for DB providers by @erichare in #14500
• fix: stop pre-selecting an unconfigured model by @Cristhianzl in #14505
• fix(deps): mend dep upgrades by @Adam-Aghili in #14528
• fix(lfx): stop reading output-side tool_mode as a tool-mode capability by @erichare in #14525
• fix(frontend): order chat messages correctly on WebKit by @Cristhianzl in #14518
• fix(a11y): make the shared playground navigable and motion-safe by @viktoravelino in #14451
• fix(a11y): label and keyboard-nav fixes for canvas fields and picker popovers by @olayinkaadelakun in #14444
• fix: rebuild drifted built-in components instead of refusing the flow by @erichare in #14527
• fix: PGVector Collection/Indexes separation per KB and MB, locale fixes by @dkaushik94 in #14473
• fix(observability): withhold log message bodies from OTLP export by default by @ogabrielluiz in #14524
• fix(security): complete image dependency remediation by @erichare in #14542
• fix(authz): make public playground links work — canonical shares and anonymous visitors by @erichare in #14539
• fix(frontend): keep a file attachment a stale file-list response omits by @erichare in #14541
• fix(authz): restrict PUBLIC flow shares to execute by @erichare in #14548
• fix(observability): correct MCP tool span attributes by @erichare in #14537
• fix: let the caller own the flow span so a run's spans nest under it by @ogabrielluiz in #14511
• fix(a11y): keep menu arrow keys from dragging the node underneath by @viktoravelino in #14543
• fix(a11y): show where keyboard focus is on the canvas, and keep it after a rename by @viktoravelino in #14544
• fix(test): run the bundle-guarded tests that CI was silently skipping by @erichare in #14556
• fix(a11y): give the knowledge base provider picker its field's name by @viktoravelino in #14560
• fix(db): ignore foreign tables in alembic check by @Cristhianzl in #14534
• fix(ci): assert the base wheel's real console script name by @erichare in #14571
• fix(auth): stop IdP bearer defects from breaking authentication (LE-2099) by @erichare in #14579
• fix(frontend): gate the add component affordance on the pending permission check by @tarciorodrigues in #14523
• fix(ci): assert the base wheel's real console script name (forward-port of #14571) by @erichare in #14582
• fix(tests): finish the public build before closing the popup; widen the messages loading-state wait by @erichare in #14595
• fix(tests): finish the public build before closing the popup; widen the messages loading-state wait (release-1.12.0) by @erichare in #14596
• fix(a11y): keep visible text in Setup Provider button's accessible name by @erichare in #14569
• fix(auth): reconcile a group set the user moved past instead of serving it from cache (LE-2099) by @erichare in #14594
• fix(security): replace eval() with safe Literal construction in schema.py by @Varshith-Kali in #14502
• fix: keep the sqlite file path out of exported database spans by @ogabrielluiz in #14559
• fix: guard against logging the caught exception on the flow execution path by @ogabrielluiz in #14561
• fix(mcp): scope tool calls and surface failures on the execution plane by @Cristhianzl in #14522
• fix(a11y): resolve dialog naming, nested-interactive, and label defects across the deploy flow by @olayinkaadelakun in #14299
• fix(ci): realign release contracts with the confluent/watsonx bundle changes by @erichare in #14625
• fix(ci): stop uv run from half-reverting the bundle install it runs against by @erichare in #14631
• fix(authz): answer denials honestly and let owners work in their own projects (LE-1905) by @erichare in #14621
• fix(a11y): distinct tab titles per route, html lang that follows the locale, no nested main by @viktoravelino in #14629
• fix(a11y): wire field labels to their controls across remaining widgets by @olayinkaadelakun in #14461
• fix: Handle duplicate name in flows batch create with 409 response by @Jkavia in #14634
• fix(ci): keep skipped package releases green and stop sending target_commitish by @erichare in #14649
• fix(ci): keep skipped package releases green and stop sending target_commitish (release-1.12.0) by @erichare in #14650
• fix(ci): stop uv run from half-reverting the bundle install it runs against (forward-port of #14631) by @erichare in #14653
• fix(a11y): name badged sidebar items by their visible text and stop phantom contrast failures in a11y scans by @viktoravelino in #14630
• fix(a11y): make keyboard focus visible on every AG-Grid table by @viktoravelino in #14627
• fix(a11y): make the flow canvas readable to a screen reader by @olayinkaadelakun in #14209
• fix(security): apply the caller-aware component policy to stored flow graphs by @erichare in #14646
• fix(security): refuse MCP stdio server configuration on the public flow path by @erichare in #14644
• fix(security): scope storage-key resolution to the executing graph's namespace by @erichare in #14645
• fix(security): require credentials on the MCP endpoints under AUTO_LOGIN by @erichare in #14643
• fix(security): check assignment values whose binding escapes the scanner's scope by @erichare in #14642
• fix(security): deny MCP stdio env vars by runtime family, not exact name by @erichare in #14641
• fix(security): apply connector SSRF policy to model-provider base URLs by @erichare in #14640
• fix(security): bind every cmd.exe execution switch to the MCP stdio wrapper allow-list by @erichare in #14635
• fix(security): scrub all secret fields on flow and project export by @erichare in #14639
• fix(security): validate the Db2 certificate fetch and contain its local-path branch by @erichare in #14637
• fix(security): enforce local-file confinement on the S3 storage branch by @erichare in #14638
• fix(security): apply the connector SSRF guard to the DataStax Data API endpoint by @erichare in #14636
• fix(frontend): dedupe template flow names across projects by @Cristhianzl in #14632
• fix(lfx): stop patching send_message on the shared component by @tarciorodrigues in #14570
• fix(frontend): surface components an administrator disabled by @keval718 in #14614
• fix(a11y): stop decorative canvas graphics reporting as unnamed by @viktoravelino in #14660
• fix(a11y): keep a tabbable row in every AG-Grid table after scrolling by @viktoravelino in #14664
• fix(models): seed IBM WatsonX with current models and stop deprecated-flag overloading by @erichare in #14670
• fix(a11y): scanner reported rules from no policy, inflating our violation counts by @viktoravelino in #14665
• fix(frontend): hide template destinations a catalog policy emptied by @keval718 in #14667
• fix(a11y): let keyboard users move nodes, create connections, and hear the canvas respond by @viktoravelino in #14673
• fix(assistant): make the message length limit configurable by @Cristhianzl in #14651
• fix(frontend): name a catalog policy only for components it blocks by @keval718 in #14681
• fix(a11y): give every canvas node a unique accessible name by @viktoravelino in #14683
• fix(a11y): give the model-picker listbox its name instead of labelling an input that does not exist by @viktoravelino in #14682
• fix(a11y): give interactive controls a boundary users can actually see by @viktoravelino in #14684
• fix(kb): gate Knowledge Base creation on every remote backend, not just pgvector by @dkaushik94 in #14686
• fix(models): keep a restricted model visible and name it in the runtime error by @erichare in #14697
• fix(lfx): bootstrap and flush OTLP telemetry on the lfx run path by @erichare in #14696
• fix(a11y): settings actions reachable at 320px, pointer targets at the 24px minimum by @viktoravelino in #14698
• fix(security): close model-provider SSRF follow-up gaps by @erichare in #14704
• fix(security): harden public MCP project execution by @erichare in #14706
• fix(security): harden generated-code boundaries by @erichare in #14708
• fix(security): enforce MCP stdio policy in components by @erichare in #14707
• fix(frontend): keep parameter visibility across a component refresh by @Cristhianzl in #14736
• fix(a11y): associate form errors with their fields instead of toast-only announcements by @viktoravelino in #14701
• fix: stop requesting a project by an undefined id after the last one is deleted by @tarciorodrigues in #14661
• fix(frontend): report every alias of a blocked component to the editor by @keval718 in #14719
• fix: correct typos in Astra DB component help text by @MsfPablo in #14734
• fix: exempt runtime-generated tweaks from the deployment policy by @ogabrielluiz in #14695
• fix: emit the stable HTTP server metric names by @ogabrielluiz in #14688
• fix: re-parent exported spans whose parent was dropped by @ogabrielluiz in #14737
• fix: stop CI Success passing over a job set that never ran by @ogabrielluiz in #14395
• fix(release): keep wheels within Docker image profile by @erichare in #14749
• fix(deployments): surface wxO create validation errors by @erichare in #14752
• fix(deployments): validate watsonx flow eligibility by @erichare in #14753
• fix(frontend): preserve dependency callback types by @erichare in #14757
• fix(amazon): send Top K only to providers with it by @Cristhianzl in #14758
• fix(agui): key tool and content dedup by ordinal by @Cristhianzl in #14759
• fix(frontend): keep canvas edits made during a save, fix Windows-flaky specs by @Cristhianzl in #14765
• fix(frontend): keep local edits over stale refresh by @Cristhianzl in #14741
• fix: send string input to OpenAI-compatible embeddings by @erichare in #14766
• fix(file): preserve raw content output for multiple files by @erichare in #14764
• fix: normalize OpenAI-compatible API base URLs by @erichare in #14774
• fix: detect Google retired-model 404 for fallback by @Cristhianzl in #14778
• fix: fail closed on provider variable read errors by @erichare in #14783
• fix: fail closed on primary API key read errors by @erichare in #14785
• fix(observability): start every request task from a clean context by @ogabrielluiz in #14769
• fix(frontend): keep sidebar add and drag affordances inside the row by @Cristhianzl in #14779
• fix(amazon): strip all Bedrock geo prefixes for Top K by @Cristhianzl in #14784
• fix(frontend): disable legacy Store tags bootstrap by @erichare in #14804
• fix(store): stop a Langflow Store outage from breaking the app by @Cristhianzl in #14803
• fix(jobs): reconcile Redis fallback orphaned jobs by @erichare in #14794
• fix(knowledge): validate Chroma collection names by @erichare in #14810
• fix(mrscraper): restore component registration by @erichare in #14797
• fix(extensions): accept release prerelease versions by @erichare in #14796
• fix(models): scope provider authorization by @erichare in #14819
• fix: allow resetting optional model provider settings by @erichare in #14799
• fix(frontend): refetch flow list when upload lands mid first load by @Cristhianzl in #14826
• fix(datastax): stop batch_size from breaking Cassandra ingest by @Cristhianzl in #14795
• fix(ollama): keep one unreachable model from emptying the picker by @Cristhianzl in #14817
• fix(api): run the caller-aware component policy on the vertex build seam by @Cristhianzl in #14808
• fix(frontend): hide "Discover more components" when it cannot navigate by @keval718 in #14798
• fix: use writable ToolGuard work directory by @erichare in #14805
• fix(security): validate runtime file tweaks by @erichare in #14809
• fix(api): preserve v2 sync tweak refusals (LE-2380) by @erichare in #14828
• fix(api): enforce targeted-input policy (LE-2386) by @erichare in #14830
• fix(security): encrypt background request overrides (LE-2381) by @erichare in #14831
• fix(frontend): keep catalog policy warning persistent by @erichare in #14807
• fix(mcp): honor API exposure in tool schemas by @erichare in #14837
• fix(security): resolve annotations without execution by @erichare in #14811
• fix(security): close component code scan gaps by @erichare in #14812
• fix(api): preserve tweak refusal reasons (LE-2387) by @erichare in #14829
• fix(frontend): show final file extension (LE-2391) by @erichare in #14840
• fix(mcp): fail on missing server dependency (LE-2388) by @erichare in #14842
• fix(ci): address release branch regressions by @erichare in #14843
• fix(frontend): fit the canvas once the whole graph is measured by @keval718 in #14832
• fix(frontend): date the UI in the language it is showing by @keval718 in #14836
• fix(frontend): translate the keys missing from every non-English locale by @keval718 in #14834
• fix(mcp): keep advertising inputs for flows that declared no allowlist by @erichare in #14855
• fix(assistant): keep in-scope builds from stalling by @Cristhianzl in #14792
• fix(memory): support non-ASCII Memory Base names by @erichare in #14875
• fix(agent): let structured output hold more than one record by @Cristhianzl in #14839
• fix(mcp): preserve public variables and expose stdio headers by @erichare in #14873
• fix: backport security and correctness fixes to 1.11.6 by @erichare in #14876
• fix(frontend): stop offering components the catalog policy blocks by @keval718 in #14827
• fix: report root error type on flow execution spans by @erichare in #14890
• fix: propagate v2 stream run ID to telemetry by @erichare in #14891
• fix(workflows): reject unsupported inline run cancellation by @erichare in #14892
• fix(api): stop the sync ceiling from capping background runs by @thesaadmirza in #14332
• fix(frontend): fetch a routed flow once per open, not once per render by @Cristhianzl in #14894

📝 Documentation Updates

• docs(authz): correct role-assignment domain types in model docstring by @erichare in #14295
• docs: database migrations by @mendonk in #14441
• docs: use EmpirioLabs AI consistently by @Adam-Dalloul in #14251
• docs: document the OpenTelemetry export and add a New Relic guide by @ogabrielluiz in #14557
• docs: add MrScraper bundle documentation by @riandradiva18 in #14655
• docs: add an Instana page for exporting Langflow telemetry over OTLP by @ogabrielluiz in #14680
• docs: clarify Arize observability setup by @arizedatngo in #14679
• docs: document the HTTP semconv rename and how to migrate by @ogabrielluiz in #14756
• docs: custom components in publicly shared flows by @Cristhianzl in #14773
• docs: 1.12 updates by @mendonk in #14744
• docs: build 1.12 APIs and bump version to 1.12 by @mendonk in #14780

🛠 Maintenance Tasks

• refactor(frontend): remove legacy Store page and routes by @olayinkaadelakun in #14141
• refactor(frontend): remove broken orphaned /flow/:id/view route by @viktoravelino in #14303
• refactor(frontend): add customization seams for telemetry toggle and registration data by @Cristhianzl in #14336
• refactor: consolidate Langflow 1.12 on langflow-base by @erichare in #14339
• refactor(frontend): re-file use-refresh-model-inputs into services and utils by @tarciorodrigues in #14045
• refactor(frontend): decompose dropdown and prompt components into hooks and helpers by @tarciorodrigues in #14054
• refactor(frontend): extract shared primitives and remove duplicated ui clones by @tarciorodrigues in #14042
• refactor(frontend): decompose DBProvidersPage into components hooks and helpers by @tarciorodrigues in #14049
• refactor: extract useGlobalVariableUpsert and adopt it in global variable modal and settings page by @tarciorodrigues in #14273
• refactor: unify prompt modals into a strategy driven PromptEditorModal by @tarciorodrigues in #14235
• refactor(frontend): decompose oversized modelInput, nodeToolbar and flowSidebar into hooks and presentational components by @tarciorodrigues in #14329
• refactor: unify the stepper machinery behind a shared provider and rebuild the deployment stepper on it by @tarciorodrigues in #14284
• refactor: align the deploy choice phase machine with the shared stepper primitive by @tarciorodrigues in #14296
• refactor: extract shared DataTableTab shell for files and knowledge tabs by @tarciorodrigues in #14249
• perf(tests): seed the loopback provider into starter templates instead of reloading by @erichare in #14589
• perf(tests): seed the loopback provider into starter templates instead of reloading (release-1.12.0) by @erichare in #14593
• chore: back-merge release-1.12.0 into main (fast-forward only) by @erichare in #14652
• chore: upgrade 1.12.0 deps by @Adam-Aghili in #14743
• refactor(sandbox): make LANGFLOW_SANDBOX_BACKEND a registry by @pratikbin in #14694

✅ Tests

• test(authz): align share-level double with enterprise enforcement semantics by @erichare in #14293
• test(a11y): shared playground IBM scan and jest-axe coverage for untested modals and primitives by @viktoravelino in #14302
• test(frontend): stabilize grouped node readiness by @erichare in #14411
• test(observability): run the claims that admit the database and URL spans by @ogabrielluiz in #14526
• test: verify log-to-trace correlation against a real OTLP collector by @ogabrielluiz in #14519
• test(observability): assert the flow span carries no exception event by @ogabrielluiz in #14535
• test: fix playground send race on Windows CI by @Cristhianzl in #14611
• test: sweep the protocol attribute across every flow entry point by @ogabrielluiz in #14613
• test(frontend): fix flaky sidebar typeahead wait in connect-tools spec by @Cristhianzl in #14691
• test: assert telemetry is inert when nothing is configured by @ogabrielluiz in #14739
• test: assert logs can be turned off while traces keep exporting by @ogabrielluiz in #14745
• test(frontend): stabilize sidebar affordance regression by @erichare in #14821
• test(frontend): classify assistant mock model by @erichare in #14833

Others

• chore: remove lfx-bundles from default Langflow install by @erichare in #13869
• chore: bump release versions to 1.12.0 by @erichare in #14196
• ci: add core/full release inventory gates by @erichare in #14203
• chore: remove unused delete-account flow (dead route, stub page, orphaned translations) by @olayinkaadelakun in #14111
• chore: add bob context file to .gitignore by @Adam-Aghili in #14558
• chore(deps): remediate Mend scan findings on release-1.12.0 by @erichare in #14555
• ci: harden nightly builds and test reliability by @erichare in #14540
• chore: back port the new workflow updates from 1.12 by @erichare in #14581
• fix(test): stop the live smoke suite inheriting the loopback server list by @erichare in #14583
• fix(ci): assert the base console script the 1.12 line actually ships by @erichare in #14584
• fix(ci): assert the base console script the 1.12 line actually ships (main) by @erichare in #14586
• fix(tests): measure the flow persistence barrier from the reload, not before it by @erichare in #14587
• fix(tests): measure the flow persistence barrier from the reload, not before it (release-1.12.0) by @erichare in #14588
• fix(ci): grant the label job pull-requests write (release-1.12.0) by @erichare in #14591
• fix(ci): grant the label job pull-requests write by @erichare in #14590
• ci: run backend tests for provider bundle changes by @erichare in #14605
• ci: run backend tests for provider bundle changes by @erichare in #14606
• ci(a11y): cut the IBM Equal Access scan from ~73 min to ~13 min per PR by @viktoravelino in #14633
• ci: stabilize nightly Windows Playwright shards by @erichare in #14726
• ci: stabilize nightly Windows Playwright shards by @erichare in #14727
• ci(a11y): stop one empty grid from killing the whole real-backend scan by @viktoravelino in #14738

New Contributors

• @Zhengcy05 made their first contribution in #13852
• @Adam-Dalloul made their first contribution in #14251
• @Varshith-Kali made their first contribution in #14502
• @Marc-oss-hub made their first contribution in #14549
• @ai-mrscraper made their first contribution in #14516
• @riandradiva18 made their first contribution in #14655
• @MsfPablo made their first contribution in #14734
• @arizedatngo made their first contribution in #14679
• @pratikbin made their first contribution in #14694

Full Changelog: v1.11.5...v1.12.0